Legacy Protocol
Medium 25 ptsA backup job over FTP, a protocol from 1971 somehow still in production. The credentials are in the clear and they are a decoy. The flag is in what the session went on to transfer.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
Follow the stream on port 21 and read the commands. Note the filename it retrieves.
Hint 2
The contents are not on port 21. FTP negotiates a second connection — look at the PASV reply.
Hint 3
That reply encodes six numbers: port = (fifth × 256) + sixth. Follow that stream.
The capture
Forged on this server. Open it in Wireshark, or run
tshark -r legacy.pcap.